CVE-2026-60085: PraisonAI RCE Vulnerability

CVE-2026-60085 Overview

CVE-2026-60085 affects PraisonAI versions before 4.6.78. The default Subprocess Sandbox backend fails to enforce configured security policies, including blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive filesystem operations despite explicit policy configuration. The flaw is categorized under [CWE-273] (Improper Check for Dropped Privileges) and stems from privileges the sandbox is expected to enforce being silently ignored at runtime.

Critical Impact
Remote, unauthenticated attackers can bypass the sandbox to run arbitrary commands and access confidential data on hosts running vulnerable PraisonAI deployments.

Affected Products

PraisonAI versions prior to 4.6.78
Deployments using the default Subprocess Sandbox backend
Applications relying on PraisonAI sandbox policy enforcement for isolation

Discovery Timeline

2026-07-15 - CVE-2026-60085 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60085

Vulnerability Analysis

PraisonAI exposes a Subprocess Sandbox intended to constrain code executed by AI agents. Administrators configure restrictions such as blocked commands, blocked filesystem paths, blocked Python imports, and toggles like allow_subprocess and allow_file_write. In versions before 4.6.78, the default backend accepts these configuration values but does not check them before executing subprocesses or performing file operations.

Because the sandbox reports as active while enforcement is absent, operators receive a false assurance of isolation. Agent-generated code, prompt-injected instructions, or attacker-supplied payloads all execute with the process privileges of the PraisonAI host, without triggering the configured denials.

Root Cause

The root cause is missing enforcement logic in the default Subprocess Sandbox backend. Policy fields are parsed and stored but never consulted by the command execution and file I/O paths. This aligns with [CWE-273], where privilege checks that should gate sensitive operations are not performed.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction where PraisonAI processes untrusted input. An attacker who can influence agent instructions, tool calls, or generated code can invoke shell commands such as data exfiltration utilities, read files listed under blocked_paths, import restricted modules, or overwrite files despite allow_file_write=False. See the GitHub Security Advisory and the VulnCheck Security Advisory for advisory-level detail.

Detection Methods for CVE-2026-60085

Indicators of Compromise

Unexpected child processes spawned by the PraisonAI runtime, such as sh, bash, curl, wget, or python -c invocations
Reads or writes targeting paths that were explicitly listed in blocked_paths
Outbound network connections initiated from the PraisonAI process to unknown hosts
Import or execution of modules listed in blocked_imports at runtime

Detection Strategies

Inventory Python environments and identify installations of praisonai at versions earlier than 4.6.78
Correlate agent prompt logs with subsequent subprocess execution events to surface policy bypass
Alert on any subprocess creation from PraisonAI worker processes when allow_subprocess is configured as False

Monitoring Recommendations

Enable process creation auditing on hosts running PraisonAI and forward events to a centralized log store
Monitor filesystem writes to sensitive directories such as /etc, /root, and application configuration paths
Track egress network traffic from PraisonAI service accounts for anomalous destinations or volumes

How to Mitigate CVE-2026-60085

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all affected hosts
Audit agent execution logs since deployment for evidence of policy bypass
Rotate credentials, API keys, and tokens accessible to the PraisonAI process if compromise is suspected

Patch Information

The fix is available in PraisonAI 4.6.78. Refer to the GitHub Security Advisory GHSA-5r6c-gj4g-r697 for release notes and the corrected enforcement logic in the Subprocess Sandbox backend.

Workarounds

Run PraisonAI inside an external isolation layer such as a container with a read-only filesystem, seccomp profile, and no network egress
Execute the PraisonAI process under a dedicated low-privilege user account with no access to sensitive paths
Disable or replace the default Subprocess Sandbox backend with an out-of-process sandbox until the upgrade is applied

bash

# Configuration example
pip install --upgrade 'praisonai>=4.6.78'
pip show praisonai | grep -i version